Infrastructure

Accessing EC2 instances used to be a hassle. Bastion hosts, SSH keys, firewall rules, each piece added another layer of complexity and potential security risks. You had to open ports, distribute keys, and constantly manage access. It felt like setting up an intricate vault just to perform simple administrative tasks.

AWS Session Manager changes the game entirely. No exposed ports, no key distribution nightmares, and a complete audit trail of every session. Think of it as replacing traditional keys and doors with a secure, on-demand teleportation system, one that logs everything.

How AWS Session Manager works

Session Manager is part of AWS Systems Manager, a fully managed service that provides secure, browser-based, and CLI-based access to EC2 instances without needing SSH or RDP. Here’s how it works:

An SSM Agent runs on the instance and communicates outbound to AWS Systems Manager.
When you start a session, AWS verifies your identity and permissions using IAM.
Once authorized, a secure channel is created between your local machine and the instance, without opening any inbound ports.

This approach significantly reduces the attack surface. There is no need to open port 22 (SSH) or 3389 (RDP) for bastion hosts. Moreover, since authentication and authorization are managed by IAM policies, you no longer have to distribute or rotate SSH keys.

Setting up AWS Session Manager

Getting started with Session Manager is straightforward. Here’s a step-by-step guide:

1. Ensure the SSM agent is installed

Most modern Amazon Machine Images (AMIs) come with the SSM Agent pre-installed. If yours doesn’t, install it manually using the following command (for Amazon Linux, Ubuntu, or RHEL):

sudo yum install -y amazon-ssm-agent
sudo systemctl enable amazon-ssm-agent
sudo systemctl start amazon-ssm-agent

2. Create an IAM Role for EC2

Your EC2 instance needs an IAM role to communicate with AWS Systems Manager. Attach a policy that grants at least the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartSession"
      ],
      "Resource": [
        "arn:aws:ec2:REGION:ACCOUNT_ID:instance/INSTANCE_ID"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:TerminateSession",
        "ssm:ResumeSession"
      ],
      "Resource": [
        "arn:aws:ssm:REGION:ACCOUNT_ID:session/${aws:username}-*"
      ]
    }
  ]
}

Replace REGION, ACCOUNT_ID, and INSTANCE_ID with your actual values. For best security practices, apply the principle of least privilege by restricting access to specific instances or tags.

3. Connect to your instance

Once the IAM role is attached, you’re ready to connect.

From the AWS Console: Navigate to EC2 > Instances, select your instance, click Connect, and choose Session Manager.

From the AWS CLI: Run:

aws ssm start-session --target i-xxxxxxxxxxxxxxxxx

That’s it, no SSH keys, no VPNs, no open ports.

Built-in security and auditing

Session Manager doesn’t just improve security, it also enhances compliance and auditing. Every session can be logged to Amazon S3 or CloudWatch Logs, capturing a full record of all executed commands. This ensures complete visibility into who accessed which instance and what actions were taken.

To enable logging, navigate to AWS Systems Manager > Session Manager, configure Session Preferences, and enable logging to an S3 bucket or CloudWatch Log Group.

Why Session Manager is better than traditional methods

Let’s compare Session Manager with traditional access methods:

Feature	Bastion Host & SSH	AWS Session Manager
Open inbound ports	Yes (22, 3389)	No
Requires SSH keys	Yes	No
Key rotation required	Yes	No
Logs session activity	Manual setup	Built-in
Works for on-premises	No	Yes

Session Manager removes unnecessary complexity. No more juggling bastion hosts, no more worrying about expired SSH keys, and no more open ports that expose your infrastructure to unnecessary risks.

Real-World applications and operational Benefits

Session Manager is not just a theoretical improvement, it delivers real-world value in multiple scenarios:

Developers can quickly access production or staging instances without security concerns.
System administrators can perform routine maintenance without managing SSH key distribution.
Security teams gain complete visibility into instance access and command history.
Hybrid cloud environments benefit from unified access across AWS and on-premises infrastructure.

With these advantages, Session Manager aligns perfectly with modern cloud-native security principles, helping teams focus on operations rather than infrastructure headaches.

In summary

AWS Session Manager isn’t just another tool, it’s a fundamental shift in how we access EC2 instances securely. If you’re still relying on bastion hosts and SSH keys, it’s time to rethink your approach.Try it out, configure logging, and experience a simpler, more secure way to manage your instances. You might never go back to the old ways.

Your browser instantly connects you to your desired website when you type in its address and hit enter. It’s a seamless experience we often take for granted. But behind this seemingly simple action lies a complex system that makes it all possible: the Domain Name System (DNS). Think of DNS as the internet’s global directory, translating human-readable domain names into the numerical IP addresses that computers use to communicate. And when managing DNS with reliability and scalability, AWS Route 53 takes center stage. Route 53 is Amazon’s highly available and scalable DNS service, designed to route traffic to your application’s resources with remarkable precision and minimal latency. In this guide, we’ll demystify the most common DNS record types and show you how to use them effectively with Route 53, using practical examples.

Let’s jump into DNS records by breaking them down into simple, relatable examples and exploring real-world use cases. We’ll see how they work together, like a well-orchestrated symphony, to make the internet navigable.

The basics of DNS Records

DNS records are like traffic signs for the internet, directing users to the right destinations. But instead of physical signs, they’re digital entries that guide web browsers and other services. Route 53 makes managing these records straightforward. Here are the most common types:

A Record (Address Record)

Think of an A Record as the street address for your website. It maps a domain name (e.g., example.com) to an IPv4 address (e.g., 192.0.2.1). It’s the most basic thing. It just tells the internet where your website lives.

Purpose: Directs traffic to web servers or other IPv4 resources.
Analogy: Imagine telling a friend to visit you at your home address, that’s what an A Record does for websites. It’s like saying, “Hey, if you’re looking for example.com, it’s over at this IP address.”
Use Case: Hosting a website like example.com on an EC2 instance or an on-premises server.

CNAME Record (Canonical Name)

A CNAME Record is like a nickname for your domain. It maps an alias domain name (e.g., www.example.com) to another “canonical” domain name (e.g., example.com).

Purpose: Simplifies management by allowing multiple domains to point to the same resource. It’s like having various roads leading to the same destination.
Analogy: It’s like calling your friend “Bob” instead of “Robert.” Both names point to the same person.
Use case: Scaling applications by mapping api.example.com to an Application Load Balancer’s DNS name, such as app-load-balancer-456.amazonaws.com. You point your CNAME to the load balancer, and the load balancer handles distributing traffic to your servers.

AAAA Record (Quad A Record)

For the modern internet, AAAA Records map domain names to IPv6 addresses (e.g., 2001:db8::1).

Purpose: Ensures compatibility with IPv6 resources, which is becoming increasingly important as the internet grows.
Analogy: Think of this as an upgrade to a new address system for the internet, ready for the future. It’s like moving from a local phone system to a global one.
Use case: Enabling access to your website via IPv6. This ensures your site is reachable by devices using the newer IPv6 standard.

MX Record (Mail Exchange)

MX Records ensure emails sent to your domain arrive at the correct mail server.

Purpose: Routes emails to the appropriate mail server.
Analogy: Like sorting mail at a post office to send it to the right address. Each piece of mail (email) needs to be directed to the correct recipient (mail server).
Use case: Configuring email for domains with Google Workspace or Microsoft 365. This ensures your emails are handled by the right service.

NS Record (Name Server)

NS Records delegate a domain or subdomain to specific name servers.

Purpose: Specifies which servers are authoritative for answering DNS queries for a domain. In other words, they know all the A records, CNAME records, etc., for that domain.
Analogy: It’s like asking a specific guide for directions within a city. That guide knows the specific area inside and out.
Use case: Delegating subdomains like dev.example.com to a different DNS provider, perhaps for testing purposes.

TXT Record (Text Record)

TXT Records store arbitrary text data, often used for domain verification or email security configurations (e.g., SPF, DKIM).

Purpose: Provides information to external systems.
Analogy: Think of it as posting a sign with instructions outside your door. This sign might say, “To verify you own this house, please show this specific code.”
Use case: Adding SPF, DKIM, and DMARC records to prevent email spoofing and improve email deliverability. This helps ensure your emails don’t end up in spam folders.

Alias Record

Exclusive to AWS, Alias Records map domain names to AWS resources like S3 buckets or CloudFront distributions without needing an IP address.

Purpose: Reduces costs and simplifies DNS management, especially within the AWS ecosystem.
Analogy: A direct shortcut to AWS resources without the extra steps. Think of it as a secret tunnel directly to your destination, bypassing traffic.
Use case: Mapping example.com to a CloudFront distribution for CDN integration. This allows for faster content delivery to users around the world. Or, say you have a static website hosted on S3. An Alias record can point your domain directly to the S3 bucket, without needing a separate web server.

Putting it all together

Let’s look at how these records work in harmony to power your website. See? It’s not so complicated when you break it down. Each record has its job, and they all work together like a well-oiled machine.

Hosting a scalable website

Register your domain: Let’s say you register example.com using Route 53.
Create an A Record: You map example.com to an EC2 instance’s IP address where your website is hosted.
Add a CNAME Record: For www.example.com, you create a CNAME pointing to example.com. This way, both addresses lead to your site.
Utilize Alias Records: To speed up content delivery, you create an Alias record connecting example.com to a CloudFront distribution. This caches your website content at edge locations closer to your users. And shall we use another Alias Record to connect static.example.com to an S3 bucket, to serve your images faster? Why not.
Implement TXT Records: You add TXT records for email authentication (SPF, DKIM) to ensure your emails are trusted and delivered reliably.
Enable health checks: Route 53 can automatically monitor the health of your EC2 instances and route traffic away from unhealthy ones, ensuring your site stays up even if a server has issues. Route 53 can even automatically remove unhealthy instances from your DNS records.

This setup ensures high availability, scalability, and secure communication. But what makes Route 53 special? It’s not just about creating these records; it’s about doing it reliably and efficiently. Route 53 is designed for high availability and low latency. It uses a global network of DNS servers to ensure your website is always reachable, even if one server or region has problems. That means faster loading times for your users, no matter where they are.

Closing thoughts

AWS Route 53 isn’t just about creating DNS records, it’s about building robust, scalable, and secure internet infrastructure. It’s about making sure your website is always available to your users, no matter what. It’s like having a team of incredibly efficient digital postal workers who know exactly how to deliver each data packet to its correct destination. And what’s fascinating is that, like a well-designed metro system, Route 53 operates on multiple levels: it can direct traffic based on latency, geolocation, or even the health status of your services. Consider for a moment the massive scale at which services like Netflix or Amazon operate, keeping their platforms running smoothly with millions of simultaneous users. Part of that magic happens thanks to services like Route 53.
The beauty of it all lies in its apparent simplicity for the end user, everything works seamlessly, but behind the scenes, there’s a complex orchestration of systems working in perfect harmony. It’s like a symphony where each DNS record is a different instrument, and Route 53 is the conductor ensuring everything sounds exactly as it should.

Secure and simplify EC2 access with AWS Session Manager